VLAN routing

[jacobwww]

My network consists of a switchA, B, C and Fierwall. I am connecting AP to switchA.

The DHCP pool for this AP (VLAN5) and for the clients that connect to it (VLAN6) is on this switchA.
In addition, this switchA has a VLAN for management (VLAN100).
Communication across VLAN100 works fine, I can go out to the Internet.
My switchA is in L3 (I enabled ip routing).
I did a default route on switchA ip route 0.0.0.0.0.0.0 10.10.100.1 (next hop on FW interface), but when I run ip icmp debug on switchB, I didn't even see traffic on it.
There is a VLAN5, 6, 100 interface on switchA, and there is a trunk between the switches that allows all VLANs.

How can I do routing so that clients who connect to the AP (will be in VLAN5) can go out to the Internet?
I would like to do routing on switchA so that I don't do VLAN5 across the network.
Are you guys able to suggest me what I am doing wrong?

[Richard Burts]

You tell us a bit of information about switch A, which seems to be working. Then say that switch B does not work. Can you tell us a bit about switch B? Starting with whether switch B is operating as layer 2 or as layer 3 switch?

[jacobwww]

At first, thanks for your attention.
From what I understand it is a L2 switch, because I can not do ip routing command there. However, on this switch, also are configured VLANs interface. Communication in VLAN100 between switchA and switchB is possible.

[Richard Burts]

We can discuss switch B, but first I would like to clarify the situation with switch A. In reading the OP I assumed that the 3 vlans (100 and 5 and 6) all worked. But in reading the discussion again I get the impression that vlan 100 works but perhaps not 5 or 6. Can you verify what does work and what does not work?

If 100 does work but 5 and 6 do not work, then my guess would be that your firewall is doing address translation for vlan 100 but not for 5 or 6. Configure address translation for those vlans. When this is resolved we can look into switch B.

[jacobwww]

Maybe I'll clarify, because I don't know if we're talking about the same thing.
I would simply like to put traffic from end users connected to the AP. Ideally, this would happen on switchA.
My question is, can I "put in" traffic from VLAN5 (from users) as it reaches switchA into VLAN100?

Let's ignore the point of this approach. Let's say it's an academic example.
I would like to achieve this approach, because since switchA is L3 and VLAN100 has full communication throughout the network, I thought that this traffic can be “put” from VLAN5 to VLAN100.

[Richard Burts]

Perhaps we have some issues with semantics. You can not put vlan 5 traffic "into" vlan 100. You can transport vlan 5 "over" vlan 100. And if ip routing is enabled on switch A that should be happening. So if traffic from vlan 5 gets to the firewall, does the firewall have logic for forwarding/translating vlan 5 traffic to forward into the Internet?

[jacobwww]

I don't understand a bit.
I thought that at this stage VLAN5 on the input to switchA would be removed and the VLAN100 tag would be applied. I am very much asking for your understanding. I am a beginner, trying to learn.

Next, I understand that I need to have a subinterface on the firewall. I gave it an address from the VLAN5 pool, only on the subinterface I have to specify a VLAN, I specified vlan 5. Is this correct? I think not no because from what I understand we will no longer have VLAN5 on the firewall because it was routed to switchA in VLAN100?
I'm guessing that you may not have time to explain in more detail. But it would help my understanding a lot if I could ask for an example description of how such traffic would go from the AP to the firewall and back. I mean the flow of such traffic including tagging. If not, I will fully understand it. Thanks for the time already spent.

[jacobwww]

Next, I understand that I need to have a subinterface on the firewall. I gave it an address from the VLAN5 pool, only on the subinterface I have to specify a VLAN, I specified vlan 5. Is this correct? I think not no because from what I understand we will no longer have VLAN5 on the firewall because it was routed to switchA in VLAN100?
I'm guessing that you may not have time to explain in more detail. But it would help my understanding a lot if I could ask for an example description of how such traffic would go from the AP to the firewall and back. I mean the flow of such traffic including tagging. If not, I will fully understand it. Thanks for the time already spent.

[Richard Burts]

I am happy to try to help you understand this better. One thing to understand is the difference between layer 2 processing and forwarding and layer 3 processing and forwarding. 

Processing for layer 2 uses the mac address of the frame and the vlan membership/tagging of the frame. Layer 2 forwarding allows devices within a vlan to communicate with each other but does not support communication between devices in different vlans. 

Processing for layer 3 uses IP addressing and the vlan tag has no effect on forwarding.

So let us think about a device that is connected in vlan 5 which wants to send something to some remote destination. It sends a frame and in the frame the destination mac address is the configured default gateway for that device (which would be the vlan interface for vlan 5). The frame arrives at the switch vlan interface, which recognizes that it is the layer 2 destination. The switch then begins to process layer 3 forwarding (and at that point the vlan tag has no function). The switch makes a layer 3 forwarding decision and forwards the frame using vlan 100 as the transit path to get to the firewall. The firewall would use layer 3 forwarding (using the IP address, not the mac or the vlan tag) to send the packet toward its destination. When the response comes back the firewall uses layer 3 forwarding to send the frame over vlan 100 to switch A, which uses the arp table to determine what mac address corresponds to the IP address, and uses layer 2 forwarding to get to the device that originated the frame.

[Richard Burts]

An additional thought is that the firewall knows about the layer 3 aspects of vlan 5 (its IP subnet) but does not know about its vlan membership or its vlan tag. So there would not be any configuration on the firewall about vlan 5 other than its IP subnet. Certainly there would be no subinterface on the firewall.

If that clarifies issues about switch A and vlan 5, is there a question about switch B?

[Richard Burts · Accepted solution]

Perhaps it might help to think a bit more about forwarding at layer 2 and forwarding at layer 3, in an Ethernet evnironment. Layer 2 forwarding is based on the concept of a frame. The frame uses mac addresses and allows communication within a vlan but does not enable communication between vlans. Layer 3 forwarding is based on the concept of a packet. The packet uses IP addresses and does allow communication between vlans.

So you have a device connected in vlan 5 to switch A. The device wants to communicate with some device that is remote. So first the device creates a packet. That packet has the data that it wants to send and it has layer 3 addresses (IP addressing and subnetting) with its own IP as source address and the IP of the destination. These addresses do not change as the packet is forwarded through the network. The device then creates a layer 2 frame. The frame uses mac addresses with the source address being the mac used by that device and the destination address being the mac of the default gateway. (The device learned the mac of the default gateway using ARP.) The device then forwards the frame through vlan 5 to switch A. Switch A removed the vlan 5 frame, looks into the routing table to discover what is the next hop, and creates a new frame for the next hop. The source mac of the new frame is the mac of switch A and the destination mac would be the mac of your firewall. The firewall would do a similar process, remove the incoming layer 2 header, look into routing table to find the next hop, build a new layer 2 frame with the addresses of that next hop. And on it goes.

[jacobwww]

I am very grateful to you for your help. Now these things are clearer to me. I will build myself an extra lab and practice similar topics.

[Richard Burts]

You are quite welcome. I remember when I was new to networking and just beginning to understand how it works that people in a forum similar to this shared what they knew and helped me to understand. I am now glad to share that with you. Thank you for marking this question as solved. This will help other participants in the community to identify discussions which have helpful information. This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.

[MHM Cisco World]

Debug can not use to see if packet pass through SW' 

Debug in SW use only for traffic To-Us 

That why it not appear.

You need to use something like 

1- check interface counter 

2- use EPC (embedded packet capture) 

MHM